Skip to content

Corpus 253 → 278: ten new threat actors

Choose a tag to compare

View all tags
@WRG-11 WRG-11 released this 23 Aug 16:21
· 9 commits to main since this release
v1.7.0
7cb2839

Corpus 253 → 278 rules: ten new threat actors and one new technique.

The generation queue held 105 candidate rules. Measured on two axes against the
live corpus, exactly 25 brought something new — ten actors the corpus did not
carry, and one technique (T1567.002). The other 80 mapped onto actors and
techniques already covered, so they stay in the queue.

New actors

barracuda, emperador, genesis, global_secret_group,
iran_nexus_tortoiseshell, kairos, ms13_089, panzer, securotrop,
shai_hulud_npm_worm.

Verified

  • Full test suite: 794 passed
  • pySigma validation: 25/25
  • Corpus quality linter: 25/25 (≤2 warnings each)
  • INDEX / README / DEMO counts regenerated from disk
  • OPSEC: no victim-level personal data, no real addresses, English only

Also includes the MCP server version-announce fix and Docker startup fix from
the unreleased window.

Assets 2
Loading